{"record":{"id":"17721a6aabdd2692","repo":"ffuf/ffuf","slug":"sniper-mode-does-not-support-command-keywords","errorCode":null,"errorMessage":"sniper mode does not support command keywords","messagePattern":"sniper mode does not support command keywords","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ffuf/optionsparser.go","lineNumber":363,"sourceCode":"\t\t\t\tKeyword:  \"FUZZ\",\n\t\t\t\tTemplate: template,\n\t\t\t}\n\t\t\t// Add encoders if set\n\t\t\tenc, ok := tmpEncoders[\"FUZZ\"]\n\t\t\tif ok {\n\t\t\t\tnewp.Encoders = enc\n\t\t\t}\n\t\t\tconf.InputProviders = append(conf.InputProviders, newp)\n\t\t}\n\t\ttmpWordlists = append(tmpWordlists, strings.Join(wl, \":\"))\n\t}\n\tconf.Wordlists = tmpWordlists\n\n\tfor _, v := range parseOpts.Input.Inputcommands {\n\t\tic := strings.SplitN(v, \":\", 2)\n\t\tif len(ic) == 2 {\n\t\t\tif conf.InputMode == \"sniper\" {\n\t\t\t\terrs.Add(fmt.Errorf(\"sniper mode does not support command keywords\"))\n\t\t\t} else {\n\t\t\t\tnewp := InputProviderConfig{\n\t\t\t\t\tName:    \"command\",\n\t\t\t\t\tValue:   ic[0],\n\t\t\t\t\tKeyword: ic[1],\n\t\t\t\t}\n\t\t\t\tenc, ok := tmpEncoders[ic[1]]\n\t\t\t\tif ok {\n\t\t\t\t\tnewp.Encoders = enc\n\t\t\t\t}\n\t\t\t\tconf.InputProviders = append(conf.InputProviders, newp)\n\t\t\t\tconf.CommandKeywords = append(conf.CommandKeywords, ic[0])\n\t\t\t}\n\t\t} else {\n\t\t\tnewp := InputProviderConfig{\n\t\t\t\tName:     \"command\",\n\t\t\t\tValue:    ic[0],\n\t\t\t\tKeyword:  \"FUZZ\",","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/ffuf/ffuf/blob/33c67d28c85b94589d029b3bcaff205a40cee9c4/pkg/ffuf/optionsparser.go#L345-L381","documentation":"In ffuf's ConfigFromOptions, an -input-cmd entry written as 'command:KEYWORD' is rejected when the input mode is 'sniper'. Sniper mode iterates each input position against a single target position one at a time, which is incompatible with command-based input providers, so the parser adds this error instead of creating the provider. This is a deliberate configuration validation, not a runtime failure.","triggerScenarios":"Calling ffuf.ConfigFromOptions with ConfigOptions whose Input.Inputcommands contains at least one entry with a ':'-separated custom keyword (len(ic)==2) while conf.InputMode == \"sniper\" (e.g. -X sniper -input-cmd 'cat words.txt:MYKW').","commonSituations":"Users switching a working pipeline from pitchfork/clusterbomb to sniper mode while keeping -input-cmd flags; shell scripts that set -X sniper globally; migrating old ffuf scripts after adding command keywords.","solutions":["Remove the custom ':KEYWORD' suffix from -input-cmd entries so they use the default FUZZ keyword... but note sniper also has keyword constraints, so prefer switching input mode","Change -X/-mode to clusterbomb or pitchfork, which support command keywords","Replace -input-cmd with a static -w wordlist generated ahead of time if sniper iteration is required"],"exampleFix":"// before\nopts.Input.InputMode = \"sniper\"\nopts.Input.Inputcommands = []string{\"sqlmap --url=FUZZU:MYKW\"}\n// after\nopts.Input.InputMode = \"pitchfork\" // or \"clusterbomb\"\nopts.Input.Inputcommands = []string{\"sqlmap --url=FUZZU:MYKW\"}","handlingStrategy":"validation","validationCode":"func validateNoSniperCommandKeywords(mode string, inputcmds []string) error {\n\tif mode == \"sniper\" {\n\t\tfor _, c := range inputcmds {\n\t\t\tif len(strings.SplitN(c, \":\", 2)) == 2 {\n\t\t\t\treturn fmt.Errorf(\"-input-cmd %q uses a custom keyword, unsupported in sniper mode\", c)\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":"func isSniperSafeInputcmd(mode string, inputcmd string) bool {\n\treturn mode != \"sniper\" || len(strings.SplitN(inputcmd, \":\", 2)) != 2\n}","tryCatchPattern":null,"preventionTips":["Check -input-cmd entries for ':' custom keywords whenever the mode is sniper","Default scripts to clusterbomb/pitchfork when command inputs are used","Add a preflight config validation before calling ConfigFromOptions"],"tags":["cli","configuration","input-validation","ffuf"],"backgroundTag":"incompatible-flag-combination","analyzedSha":"33c67d28c85b94589d029b3bcaff205a40cee9c4","analyzedAt":"2026-09-04T18:24:34.068Z","contentChangedAt":"2026-09-04T18:24:34.068Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}